What passed, what failed, and what is still only a bet.

Current unreleased main · verified 2026-09-01

Current main is 01e94b2, 220 commits beyond v1.1.0. The latest packaged release remains v1.1.0, so the thirteen-tool harness contract on this site is explicitly current-main documentation. The latest GitHub CI run passed on that exact commit.

The current harness separates deterministic reorientation from ranked knowledge. brain.briefing has no query and a 1,500-character default ceiling; brain.ledger groups verified, failed, and in-flight closeouts by task reference; goals point to Git-versioned specs and executable finish lines. Ranked brain.context remains the separate answer to “what do I know about this?”

The hardening line through PRs #53–62 also added scope-reachable gotchas, public leak-shape scanning, fail-closed duplicate checks, strict session identity and unresolved-failure reporting, exact locator misses, egress auditability, and a tracked-file retired-model guard. These are source and test claims. Fresh model-driven acceptance in every possible client/environment and new release assets remain separate gates.

Environment-verified v1 snapshot · 2026-07-13

This is the verified source, migration, and fresh-client acceptance state on one machine on one date. The version numbers are evidence about that run rather than a promise that they will always be the latest releases.

The July 10 proof remains historical evidence for the v0.4 brain.search surface. On July 13, fresh Codex, Claude Code, and OpenClaw processes separately completed context → source → feedback → closeout against the same v1.0.1 live core. All three source expansions were hash-verified, all three context retrievals were marked helpful, and all three verified closeouts landed in that database.

The acceptance also found a stale pre-v1 Runtime Integration source preserved by migration. The current file was re-imported as project-scoped evidence, both serving legacy duplicates were retracted by append-only correction events, and a post-correction context/source check returned the new belief with a verified hash. OpenClaw's final acceptance used that refreshed source.

The current source fails closed at the expensive boundaries.

The lock-window result matters.

A previous implementation let retrieval-audit logging turn a successful read into database is locked. The current path separates the two outcomes. Search still returns scoped context, while the response says retrieval_use_status=database_busy and omits the feedback handle.

An earlier Claude acceptance hit that exact condition. Claude used the successful read and did not retry merely to manufacture an audit id. That remains a passed concurrency behavior, not a feedback record; the later Opus 4.8 acceptance completed both search and recorded feedback.

The release audit found five forms of the same mistake: one dataset transaction stayed open across 3,712.6 seconds of parsing, autolabel kept signal writes open across FTS searches, review held its first write while the lazy iterator parsed later transcripts, hosted judge/embedding calls waited on TLS after writing their audits, and persona preparation still ran after acquiring the writer. v0.3.2 bounds those paths and keeps parsing, quality work, and network I/O outside SQLite transactions. After the original live writer exited, a safe checkpoint reduced the WAL from 625,436,632 bytes to zero.

Historically, the passive stall watcher committed deadman evidence before optional paging. v0.4.1 retired its schedule, and the later ocbrain-ops companion was deleted with the rest of the unused companion surface. That architecture is historical evidence, not current product behavior.

Historical v0.3.1 probes allowed 39 of 40 writer attempts during review and 40 of 40 during tripwires and promotion. The later heavy ledger exposed a 27.457-second persona hold, so v0.3.2 moved redaction, serialization, quality scoring, and dedup reads outside the transaction. Post-fix stress runs measured a 0.001128-second maximum across 200 large persona examples and 0.000863 seconds across one 200-tool-turn review session.

The v0.3.3 live audit verified the complete 306,974-event hash chain and reproduced all 101,641 projected beliefs byte-for-byte. It repaired five legacy foreign-key references without deleting their retrieval history, removed 5,202 parentless FTS rows, and left both checks at zero. A composite tripwire cursor closed an equal-timestamp skip window; replacing a per-row full-event-log scan with an indexed lookup cut a clean 1,000-row page from 301.2534 seconds to 0.0351 seconds.

The same historical release made watchdog state durable: old findings outside the paging window retire once, failed delivery still retries, and an unchanged deadman state does not manufacture duplicate evidence. Those results describe the retired scheduled architecture, not the v0.4.1 default install.

Six v1 gates stand between the lake and a runtime.

The autonomy boundary is narrow on purpose.

When explicitly invoked, the core may reconcile its event projection, retrieve context, expand exact sources, append evidence, record feedback, manage verifier-backed goals, supersede a proven-wrong belief, and close out a task. None of those operations is scheduled by the default install, and none grants general execution authority.

• It does not enqueue or execute agent work.
• It does not install skills or ship packages.
• It does not enable hosted judgment or embedding merely because a credential exists or a preview passed.
• It does not export the training corpus to a hosted endpoint.
• It does not destructively delete the evidence ledger as ordinary maintenance.

The second fine-tune improved and still failed the model-quality bar.

Pilot two reused the first pilot's twenty prompts, references, rubric, held-out hashes, and blind randomization byte-for-byte. Eleven canonical first-party examples were added locally; ten cleared the unchanged 0.8 grade threshold. The same pinned base and trainer then ran for fifty steps, with validation loss moving from 2.648 to 2.359.

The original blind run used an automated 7/8 calibration preflight. On July 10, eight direct human decisions replaced those machine-authored expected winners as the calibration truth. v0.4 fixed the evaluator rubric without changing a label or lowering the 90% gate; the local Gemma judge passed 8/8. Calibration-only mode never opened the blind set, so the twenty model ratings and the 7-to-13 result were not rerun.

The candidate improved from 2 preferences to 7, while the reference won 13. Candidate voice fidelity rose from 2.25 to 3.05, and naturalness rose from 2.90 to 3.50. That is real corpus progress. It is still a model-quality failure.

The useful conclusion remains the same: the evaluation can reject a weak model before anyone starts believing its style is Jonathan's.

What could still be wrong.

• Judge calibration. The local judge passed 8/8 direct human labels, but eight decisions are still a small calibration set. New disagreement cases should expand the set instead of making the gate easier.
• Single-writer contention. The known long transactions are now bounded and measured, but SQLite still has one writer and new write-heavy stages need the same discipline.
• Feedback coverage. The frozen retrieval suite now measures relevance, citations, scope, negative probes, and injection probes. The harder live metric is whether agents report or conservatively infer what actually changed the result.
• Pilot-v3 corpus. The AI-delegated 150-item review found 67 pass / 83 fail. Those labels are remediation evidence, not named-human approval. Remediation, reminting, local regrading, a fresh stratified named-human audit, and separate operator authorization remain required.
• Acceptance durability. Fresh Codex, Claude Code, and OpenClaw processes passed for v1.0.1 on July 13. Hermes is now documented as a first-class compatible client, but every future release must repeat the real round trip in every claimed runtime; configuration and historical receipts are not enough.
• v1 activation. The pointer is retained after three-client acceptance, but cutover remains reversible and the immutable v0 archive remains the audit source—not a hidden runtime fallback.
• Single-machine fragility. The corpus has no automatic off-machine backup because a backup widens the privacy surface. That remains an operator decision.
• Operator configuration. OpenClaw's own doctor still warns about plaintext operator credentials until a SecretRef provider is chosen. No credential or local config is part of the ocbrain repository or release.

Reproduce the source gate.

PYTHONPATH=src uv run pytest -q
uv run ruff check .
uv run --with-editable . python -m compileall src tests
git diff --check

Runtime proof commands and the model-driven acceptance prompt are in the install guide. The current architecture and pilot contract live with the source.